In this guide 7 sections
Cyber insurance requirements in Australia have tightened. Insurers now ask detailed questions about your security controls before they offer a cyber insurance policy, and they can decline a claim if you said a control was in place and it wasn't. To meet cyber insurance requirements, most small businesses need enforced multi-factor authentication, endpoint detection and response, backups that attackers can't delete, patching, email filtering, regular security awareness training and a written incident response plan. The stronger your controls, the easier cover is to get and the lower the cyber insurance cost.
What cyber insurance covers
Cyber insurance (also called cyber liability insurance) protects a business from the financial losses of a cyber event such as a data breach, ransomware attack or email fraud. Cyber insurance coverage usually has two parts:
First party losses, your own costs:
- Incident response support: forensic experts, IT recovery and crisis management
- Data recovery, system restoration and system recovery costs
- Business interruption and lost income while systems are down
- Cyber extortion, including ransom payment where legal and approved
- Notification costs after a breach of customer records or sensitive information
Third party losses, claims against you:
- Legal fees and liability if client or customer data is exposed
- Costs from regulators or government agencies, where insurable
- Claims arising from unauthorised disclosure of sensitive data
Not all cyber policies are created equal. Some exclude social engineering fraud or cap it with a low sublimit, and business interruption cover varies widely. Public liability insurance and professional indemnity usually don't cover cyber incidents, so check what each policy covers.
The security controls insurers ask about
| Control | What insurers want to see | Notes |
|---|---|---|
| Multi-factor authentication | Enforced on email, remote access, admin accounts and cloud platforms | The most scrutinised control. "Available" isn't "enforced". |
| Endpoint detection and response (EDR) | On every computer and server | Basic antivirus software alone often isn't enough |
| Backups | Regular, offline or immutable, separate credentials, restores tested | Protects data recovery after ransomware attacks |
| Patching | A documented process, critical updates applied quickly | Unsupported computer systems are a red flag |
| Email security | Filtering for phishing, malware attacks and impersonation | Plus SPF, DKIM and DMARC on your domain |
| Admin privileges | Staff don't use admin accounts day to day | One of the Essential Eight controls |
| Regular security awareness training | At least annually, ideally with phishing simulations | Human error is behind many cyber incidents |
| Incident response plan | Written, dated, with named people and incident response teams or providers | Even a short plan is better than none |
| Payment verification | Bank detail changes verified by phone | Key for business email compromise cover |
| Vulnerability testing | Some insurers ask about scans or penetration testing | More common for medium businesses |
Many of these proactive security measures map directly to the Essential Eight. Some Australian insurers and brokers also recognise SMB1001, a certification standard aimed at small businesses.
Why cyber insurance requirements are tightening
Cyber threats have grown and so have claims. Threat actors target small businesses because they hold valuable customer records and sensitive information, often with weaker defences. In ASD's Annual Cyber Threat Report 2024–25, the average self-reported cost of cybercrime for a small business was $56,600 per report. With rising costs in the cyber insurance market, insurers now verify controls and use them to price cyber risks.
What drives cyber insurance cost
Cyber insurance cost depends on:
- Business size and revenue.
- Industry, since businesses holding health, financial or large volumes of personal data usually pay more.
- Cover limit and excess.
- Claims history.
- Your security controls, where strong controls can reduce premiums or make cover possible at all.
Premium figures you see online are often from the US. Get Australian cyber insurance options and quotes through a broker.
How to meet cyber insurance requirements before renewal
- Get the questionnaire early, at least a month before renewal.
- Answer from evidence, not memory. Ask your IT provider for reports: MFA enforcement, EDR coverage, patch status, backup restore tests.
- Identify weaknesses and fix gaps before you apply. Enforcing MFA everywhere is usually the fastest, biggest improvement.
- Be accurate. An answer that overstates your controls can put a future claim at risk.
- Keep a copy of what you submitted and the evidence behind it.
- Plan for emerging threats by reviewing controls each year, not just at renewal.
Static Computers' view
Static Computers helps clients meet cyber insurance requirements with evidence from their own systems, and flags any answer that can't honestly be "yes" yet. An Essential Eight assessment covers most of what insurers ask, and technical support is available to fix gaps before renewal. Static Computers doesn't sell insurance; talk to a broker for cyber insurance cover and pricing.